The words
Enlarge / Florida’s apparently being a bit of too welcoming in the mean time.

Florida police mentioned a raid they performed Monday on the Tallahassee dwelling of Rebekah Jones, a knowledge scientist who the state fired from her job in Could, was a part of an investigation into an unauthorized entry of a state emergency-responder system. It seems, nevertheless, that not solely do all state staff with entry to that system share a single username and password, but additionally these credentials are publicly obtainable on the Web for anybody to learn.

The background

Jones on Monday shared a video of the police raid on her home as a part of a Twitter thread by which she defined the police had been serving a search warrant on her home following a criticism from the Division of Well being. That criticism, in flip, was associated to a message despatched to Florida emergency responders again in November.

About 1,700 members of Florida’s emergency-response staff obtained the communication on November 10, in keeping with the affidavit (PDF) cited within the search warrant for Jones’ dwelling. The message urged recipients to “converse up earlier than one other 17,000 individuals are useless. You recognize that is flawed. You don’t should be part of this. Be a hero. Converse out earlier than it is too late.”

That unauthorized message was despatched to the contact listing for Florida’s Emergency Assist Perform 8, or ESF-8, considered one of 18 teams of Florida state emergency-response personnel. ESF-8 is headed underneath the Florida Division of Well being and coordinates public well being response, together with “triage, therapy, and transportation” throughout a number of businesses. All customers within the group share the identical username and password, the affidavit confirms. Investigators checked out system logs and recognized an IPv6 handle related to the message, which they then decided to be linked to Jones’ home.

After the raid on her dwelling, Jones gave a number of media interviews by which she repeatedly denied having something to do with the message. To CNN, for instance, she mentioned, “I am not a hacker,” and added that neither the tone nor the content material of the message match her communications fashion.

(In)safety

In November, when the message went out, state DOH spokesman Jason Mahon declined to reply the Tampa Bay Occasions’ questions on “what, if something, had been finished to raised safe the emergency alert system in opposition to future hacks, nor whether or not there have been different situations the place the system had been hacked.”

It now appears the Occasions’ query could have gone unanswered as a result of the Florida Division of Well being had no reply, aside from to proceed dangerous safety practices.

“All customers assigned to [ESF-8 tools] share the identical username and password,” the affidavit cited within the search warrant confirmed. That set of login credentials apparently doesn’t change when customers resign or are fired; as an alternative, “as soon as [employees] are now not related to ESF8 they’re now not licensed to entry the multi-user group.”

That set of account credentials that every one customers share is a part of a logistics operation guide that’s publicly searchable and accessible on the Florida DOH’s web site.

A redacted screenshot from a publicly available PDF showing the login information for ESF-8 communications systems. This is the kind of information you might tack up in your cubicle—not the kind of information you want all over the Internet.
Enlarge / A redacted screenshot from a publicly obtainable PDF displaying the login data for ESF-8 communications programs. That is the sort of data you may tack up in your cubicle—not the sort of data you need everywhere in the Web.

A hyperlink to the guide was shared in a Reddit thread discussing the raid on Jones’ home, which a number of Ars readers flagged to us. (Thanks!) We’re selecting to not share a direct hyperlink, however as of publication time, the hyperlink was nonetheless dwell and dealing.

The doc is a suggestion for ESF-8 logistics workers. The primary part features a listing of duties administration want to finish in sure given durations. The second part features a listing of programs log-in data together with factors of contact for every of these programs if they need to be wanted. It is the sort of data anybody who has labored in an administrative or help function for any group has seemingly had available—for inner use solely.

Ars contacted the Florida Division of Well being concerning the doc previous to publication; officers didn’t instantly present a response. We’ll replace this story if we obtain extra remark.

Extra reporting contributed by Timothy Lee.

LEAVE A REPLY

Please enter your comment!
Please enter your name here